SSL Certificate Checker: expiry, issuer and chain
Inspect the TLS certificate of any HTTPS host. Issuer, expiry, SAN list, full chain, TLS version and fingerprints. Live handshake, no cache, no sign-up.
- Live TLS handshake, not a cached copy
- Days remaining with colour warning
- Full chain and SAN coverage
- Trust validation result
Check any HTTPS certificate
Enter a hostname to see its TLS certificate — issuer, expiry, covered domains, chain and fingerprints.
- 100% Free
- Live TLS Handshake
- Full Chain
- SAN Coverage
- Expiry Warning
- No Sign-up
What every field means
A certificate has more useful information than most people realise. Here is what each field tells you.
| Field | What it says | Typical use |
|---|---|---|
| Issuer | The certificate authority that signed this certificate | Confirming the CA: Let's Encrypt, DigiCert, Cloudflare, etc. |
| Subject | Whose certificate it is (usually the domain and org) | Sanity-checking the identity |
| Valid from / to | The start and end of the certificate's validity window | Planning renewal, spotting a clock skew issue |
| Days remaining | How many days until expiry, colour-coded | The single number most people need |
| SAN | Every hostname this certificate is valid for | Checking subdomain coverage, wildcard scope |
| Chain | Intermediate certificates between the leaf and the root | Diagnosing "not trusted" warnings |
| Protocol / Cipher | The negotiated TLS version and cipher suite | Security posture, spotting TLS 1.0 endpoints |
| SHA-1 / SHA-256 fingerprint | Unique identifiers for this specific certificate | Certificate pinning, ticket trails |
| Serial number | The CA's serial number for the cert | Certificate Transparency lookups |
| Trust status | Whether the chain validates against the system trust store | Confirming that browsers will not warn |
Why this is the best free SSL checker
Most SSL checkers are ad-heavy single-field pages. This one shows the full picture with a live handshake.
| Feature | TToolDeck | Typical SSL checker sites | CLI tools (openssl, curl) |
|---|---|---|---|
| No sign-up or email | Yes | Partial | No |
| No ads blocking the input | Yes | No | Partial |
| Live TLS handshake (real cert, not cached) | Yes | Partial | Yes |
| Days remaining with colour-coded warning | Yes | Partial | Yes |
| Full Subject Alternative Names list | Yes | Partial | Yes |
| Certificate chain (intermediates) | Yes | Partial | Yes |
| TLS protocol and cipher reported | Yes | No | Partial |
| SHA-1 and SHA-256 fingerprints | Yes | Partial | Yes |
| Copy each field in one tap | Yes | No | No |
| Recent lookups saved locally | Yes | No | Partial |
Comparison reflects publicly available information at the time of writing. Features may change. Representative examples of common patterns.
More free network tools
Free browser-based network tools. Nothing uploaded, ever.
IP Address Lookup
Geolocation, ISP, timezone and coordinates
DNS Lookup
Query A, AAAA, MX, TXT and other records
Game Ping Test
Real ping to PUBG, Valorant, CS2 and 16 more
Website Speed Test
See how fast any website loads for you
SSL Certificate Checker
You are hereCheck any HTTPS certificate for expiry
QR Code Generator
QR codes for URLs, WiFi, WhatsApp and more
Password Generator
Strong random passwords on your device
JSON Formatter
Format, validate and convert JSON
Text to Speech
Turn any text into spoken audio
How it works
- 1
Enter a hostname
Type any hostname, such as example.com, api.github.com or mail.yoursite.com. The tool does not need a full URL, just the hostname that serves HTTPS.
- 2
The TLS handshake runs server-side
A real TLS connection is opened to the host on port 443 from our Node.js runtime. The certificate the server presents is read live, with no cache and no intermediate proxy.
- 3
Read everything in one view
Issuer, subject, validity window, days remaining, SAN list, full chain, TLS protocol, cipher, and both fingerprints. Copy any field with one tap.
Everything you get for free
Real TLS handshake, not a cache
The tool opens a genuine TLS connection to the target host on port 443 and reads the certificate the server actually presents right now. No stale copies, no CDN edge caches, no guessing.
Expiry in plain days, with colour codes
The single number everyone cares about, days until the certificate expires, is front and centre. Green for fresh, blue for healthy, amber for under 30 days, red for under 7 or already expired.
Subject Alternative Names (SAN)
The full list of every domain the certificate covers: the apex, all www variants, API subdomains and wildcard entries. If you are moving a domain or adding a subdomain, this is the fastest way to know whether your current cert already handles it.
Full chain walk
Every certificate between your leaf cert and the root CA, with issuer CN and validity dates. A missing intermediate is one of the most common reasons a certificate "works in Chrome but not in curl". This view finds the gap instantly.
TLS protocol and cipher
Which TLS version the server negotiated, and which cipher suite it chose. Useful for security audits: spotting TLS 1.0 still in use, or a deprecated RC4 cipher, takes one look.
SHA-1 and SHA-256 fingerprints
Both the SHA-1 and SHA-256 fingerprints of the certificate, plus the serial number. Copied in one tap, useful for pinning, ticket trails and certificate transparency lookups.
Trust validation result
The chain is validated against the system trust store. If the certificate is self-signed, expired, or not trusted for another reason, the tool shows the exact error string. It is the same diagnostic a browser or curl would report.
Recent lookups saved locally
The last six hostnames you checked are stored in your browser's localStorage. Tap any one to re-run the check. Perfect for monitoring a certificate over the last few days before its renewal date.
What people use it for
Check before a certificate expires
Your renewal reminder says the cert expires "soon". Look it up here to see the exact date, how many days are left, and the current issuer, all without logging into your hosting panel or the ACME client.
Debug a "certificate not trusted" error
When a site shows a warning in one browser but not another, the chain is usually the culprit. The chain view shows every intermediate certificate and where the trust walk stops, which is the exact information needed to fix it.
Audit which domains a cert covers
Moving to a new subdomain? Adding an API endpoint? Check the SAN list to see whether your existing wildcard or multi-domain cert already covers the new hostname, or whether you need to reissue.
Security posture review
See which TLS version a server negotiates and which cipher it uses. A quick way to spot outdated TLS 1.0 endpoints, weak cipher suites, or a server that is not yet on TLS 1.3.
Verify a certificate before you trust a site
Buying from an unfamiliar store or clicking through from an email? Check the issuer and covered domains before entering card details. A mismatched SAN list is a red flag even if the green padlock shows.
Monitor competitors and infrastructure
See who issues certificates for a given site (Let's Encrypt, DigiCert, Cloudflare or a private CA) and how often they rotate. A small window into how a team runs its infrastructure.
Questions people ask
How does this SSL certificate checker work?
When you enter a hostname, the tool opens a real TLS connection to that host on port 443 from a Node.js runtime. The server responds with its certificate during the handshake, and we read every field from that response: issuer, subject, validity dates, SAN list, chain, TLS version and cipher. Nothing is cached; you see the same certificate any browser would see right now.
Why do I need a server-side tool? Can't this run in the browser?
No, and this is a genuine browser limitation. Browsers hide the TLS certificate from JavaScript entirely. By the time your code runs, the handshake is already done and the certificate details are not exposed. The only way to inspect a certificate is from a client that can complete the handshake and read the response, which is what the server-side route does.
What does "days remaining" mean, and why is it colour-coded?
It is the number of days between today and the certificate's "not after" date. The colour codes are a rough triage: green for more than 90 days, blue for 30-90, amber for 7-30, red for less than 7 or already expired. Let's Encrypt certs are 90 days by design, so a "green" Let's Encrypt cert usually means it was renewed recently.
What are Subject Alternative Names (SANs)?
A SAN is any hostname that a certificate is valid for. A certificate for example.com typically also lists www.example.com. A wildcard certificate lists *.example.com and covers all one-level subdomains. The SAN list is the definitive answer to "does this certificate cover this hostname". If the hostname is not in the list (and does not match a wildcard), browsers will reject the connection.
What is the certificate chain?
A TLS certificate is never trusted directly by your browser. Instead, it is signed by an intermediate CA, which is signed by a root CA that your operating system already trusts. The chain is the list of every certificate between the leaf (yours) and the root. If the server forgets to send an intermediate, browsers using AIA fetching may still succeed while command-line tools fail. This is the classic "works in Chrome, fails in curl" bug that the chain view makes obvious.
Why does the trust status say "No"?
Three common reasons. The certificate may be self-signed (the issuer is the same as the subject). It may be issued by a private or internal CA that is not in the public trust store. Or the chain may be incomplete, with an intermediate missing that the system trust store cannot fill in. The exact error string shown by the tool matches what you would see from curl or openssl.
Does this check work on any hostname?
Any hostname that serves HTTPS on port 443. That includes apex domains, subdomains, and IP addresses that have certificates. It will not work on hosts that only serve HTTP, hosts behind a load balancer that drops the TLS handshake, or internal hosts that require VPN access. The tool will return a clear error for each of those.
Why does my hostname sometimes show a different issuer than I expect?
Large sites often serve different certificates based on which edge node handles the request. If you are behind a CDN, the cert you see is the one for the edge, which may be issued by the CDN's own CA (Cloudflare, Fastly, CloudFront) rather than your origin's cert. That is normal and expected.
How does the tool know the certificate is trusted?
The Node.js runtime validates the chain against its system trust store, the same root CA list that ships with your operating system. If validation fails, the tool records the exact error and shows it to you. If it succeeds, "Trusted: Yes" is shown. This mirrors the trust decision any browser would make.
Is my query logged?
No. The tool does not log hostnames, does not persist the certificate data, and does not store any query history server-side. Recent lookups are kept in your browser's localStorage only, visible in the "Recent" row after you have done a few lookups. Clearing site data resets everything.
Is there a rate limit?
No hard limit, but each lookup opens a real TLS connection to the target, so it takes 200-800 ms depending on the server's distance from the runtime. Running dozens of lookups per second is not a supported workload. That is a monitoring use case, and you should use a certificate transparency API for that.
Is it free, and can I use it at work?
Completely free for personal and commercial use. No sign-up, no email, no ads blocking the input, no daily limit. Everything runs from a stateless serverless function with no persistent storage. Safe to use on internal hostnames as long as those hostnames are reachable from the public internet, which is a technical requirement, not a policy one.
Queries are not logged
Every lookup runs from a stateless serverless function. The hostname you query is used to open a TLS connection and is discarded the moment the response is returned. Recent lookups are stored in your browser's localStorage only. See why ToolDeck is different.